Least Functionality is the requirement that keeps a system from doing more than it needs to. Configuration Settings (03.04.02) hardens what the system runs, and Least Functionality (03.04.06) reduces what the system offers in the first place. It has four (4) parts: configure the system to provide only mission-essential capabilities, prohibit or restrict a defined set of functions, ports, protocols, connections, and services, review the system on a defined frequency to find unnecessary or nonsecure ones, and disable or remove those that are unnecessary or nonsecure. Per the NIST discussion, functions and services provided by default may not be needed, running multiple services on one component increases risk, and organizations disable unused ports and protocols to prevent unauthorized connections, information transfer, and tunneling.
A common difficulty with this requirement is defining a hardened baseline once and never revisiting it. Least functionality is a recurring discipline, not a one-time cleanup. R3 wraps six (6) Organization-Defined Parameters (ODPs) around this control, five for the functions, ports, protocols, connections, and services to prohibit or restrict, and one for the review frequency. For Department of Defense (DoD) contractors, the review frequency is specified.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.04.06 Least Functionality. Only the formatting has been adjusted for readability. This requirement has four (4) lettered parts:
The source controls are CM-07 and CM-07(01) from NIST 800-53. Part b contains one bracketed assignment covering the functions, ports, protocols, connections, and services, and part c contains the review frequency, which the assessment procedures break into six (6) Organization-Defined Parameters (ODPs). Per the NIST discussion, File Transfer Protocol (FTP), Bluetooth, and peer-to-peer networking are examples of protocols organizations consider eliminating, restricting, or disabling. You can read the requirement directly at NIST 800-171 R3, 03.04.06 (p. 30).
Two (2) values sit inside this requirement. Depending on your contract, your organization may be permitted to define them. Organizations in the DIB subject to CMMC are not, because the DoD has defined them as policy.
The values below come from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
The guidance for 03.04.06.b, quoted from the memo:
Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
Note the asymmetry: NIST 800-171A R3 decomposes this requirement into six (6) Organization-Defined Parameters, while the DoD memorandum addresses them with two (2) entries, because a single bracketed assignment in the requirement text covers more than one parameter under assessment. Each ODP still needs its own answer in the System Security Plan (SSP).
Where the memo gives guidance rather than a fixed value, the guidance tells you how to approach the decision and the decision itself remains yours to make and document. The memorandum does this in four (4) instances across the whole publication.
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
NIST 800-171A R3 breaks 03.04.06 into fourteen (14) assessment objectives: six (6) Organization-Defined Parameters (ODPs) and eight (8) determination statements. These AOs are:
The single assignment in part b becomes five separate ODPs and five separate prohibit-or-restrict objectives, one each for functions, ports, protocols, connections, and services. If you are a DoD contractor, the review frequency is specified. Per the DoD-specified ODP value in ComplianceForge's NIST 800-171 R3 Transition Guide, the review frequency (ODP[06]) is at least every twelve (12) months, when any system functions, ports, protocols, or services changes are made, and after any significant incidents or significant changes to risks, and the DoD guidance for the prohibited-or-restricted set emphasizes limiting to a single function per component and using scanning, intrusion detection, and endpoint protection to enforce it. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.04.06 (p. 36).
Examine: configuration management policy and procedures; procedures for least functionality in the system; configuration management plan; system design documentation; system configuration settings; system component inventory; common secure configuration checklists; documented reviews of functions, ports, protocols, and services; change control records; system audit records; system security plan.
Interview: personnel with configuration management responsibilities; personnel with responsibilities for reviewing functions, ports, protocols, and services; personnel with information security responsibilities; system developers; system administrators.
Test: processes for prohibiting or restricting functions, ports, protocols, and services; processes for reviewing or disabling functions, ports, protocols, and services; mechanisms for implementing the review and disabling of functions, ports, protocols, and services; mechanisms for implementing restrictions on or the prohibition of functions, ports, protocols, and services.
03.04.06 maps from NIST 800-171 R2 requirement 3.4.6 (employ the principle of least functionality by configuring organizational systems to provide only essential capabilities), and it absorbs R2 requirement 3.4.7 (restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services):
Mapped against the fourteen (14) AOs, all fourteen (14) are indirect (moderate effort), with no net-new AOs and none with no mapping. On paper that means no brand-new objectives, but the indirect mapping is significant. R3 pulled the essential-capabilities requirement (3.4.6) together with the nonessential-functionality requirement (3.4.7) into one control and restructured them around defined sets of functions, ports, protocols, connections, and services plus a recurring review. Re-analyze rather than assume your R2 evidence transfers, because the structure changed even though the intent did not.
Source Controls in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.04.06 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The following are issues teams may encounter rather than certainties. They are about the recurring review and the breadth of the parameters, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.04.06 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.04.06 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.04.06 recording the ODP values you adopted.
With all fourteen (14) AOs mapping indirectly, 03.04.06 is a moderate lift, but the consolidation from two R2 requirements and the recurring review make it real work. A realistic sequence:
What value does the DoD require for the first parameter in NIST 800-171 R3 03.04.06? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.04.06.b: guidance rather than a fixed value. Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
How many assessment objectives does NIST 800-171 R3 03.04.06 have? NIST 800-171A R3 breaks 03.04.06 into fourteen (14) assessment objectives: six (6) Organization-Defined Parameters (ODPs) and eight (8) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.04.06 come from? CM-07, CM-07(01).
Where does NIST 800-171 R3 03.04.06 sit in the NIST 800-171 R3 Kill Chain? Phase 12, Secure Baseline Configurations (SBC). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.04.06 Least Functionality configures the system to mission-essential capabilities, prohibits or restricts defined functions, ports, protocols, connections, and services, and reviews and removes what is unnecessary or nonsecure. It maps from R2 3.4.6 and absorbs 3.4.7, with all fourteen (14) assessment objectives transitioning indirectly, so there is no net-new objective but real restructuring. The recurring problem is a one-time hardening with no recurring review. Define the five (5) categories and the review frequency (for DoD, at least every twelve months and on relevant changes), configure to essential-only, and run the review-and-removal cycle.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
